Electronic control device and calculation method

ABSTRACT

An electronic control device includes: a first processing unit; a second processing unit; and a transfer control unit. The second processing unit requires a longer time for an activation process than the first processing unit, the transfer control unit includes a communication unit capable of transferring communication data received from an outside to the first processing unit and the second processing unit, the first processing unit includes a first control part that processes the communication data transferred from the transfer control unit, the second processing unit includes a second control part that processes the communication data transferred from the transfer control unit, and the transfer control unit does not set the second processing unit as a transfer destination of the communication data and sets the first processing unit to be included in the transfer destination until the activation process of the second processing unit is completed and sets at least the second processing unit as the transfer destination of the communication data when the activation process of the second processing unit is completed.

TECHNICAL FIELD

The present invention relates to an electronic control device and acalculation method.

BACKGROUND ART

An in-vehicle network is connected to an external network such as theInternet or a wireless LAN, so that convenience of a user is improved,but it is pointed out that there is a risk that an electronic controldevice is hijacked by a cyberattack from outside the vehicle. Therefore,in order to prove that an automobile is safe, it is desirable to operatea function after it is confirmed at the time of activating theautomobile that a program in the automobile is not falsified. Inaddition, it is desired to operate the function early from the viewpointof convenience of the user. As a method of verifying the safety of theprogram, a method of comparing whether a signature value created inadvance matches a signature value created from the current program isgenerally known, and a method of activating the program after verifyingthe safety is called secure boot. When this secure boot is performed, itis inevitable that a longer time is required for activation than before.PTL 1 discloses a secure boot method in which a computer executes, everytime a program of a system is activated, a selection step of selecting adifferent partial program to be verified for a hash value from among aplurality of partial programs obtained by dividing the program, acalculation step of calculating the hash value of the selected partialprogram, and a verification step of determining whether or not thecalculated hash value matches a correct part hash value which is acorrect hash value of each of the plurality of partial programs,continuing an activation process of the system in a case where thecalculated hash value matches the correct part hash value, andinterrupting the activation process of the system in a case where thecalculated hash value does not match the correct part hash value.

CITATION LIST Patent Literature

-   PTL 1: JP 2015-022521 A

SUMMARY OF INVENTION Technical Problem

In the invention described in PTL 1, communication data cannot beprocessed before the activation process is completed.

Solution to Problem

An electronic control device according to a first aspect of the presentinvention is an electronic control device including: a first processingunit; a second processing unit; and a transfer control unit. The secondprocessing unit requires a longer time for an activation process thanthe first processing unit, the transfer control unit includes acommunication unit capable of transferring communication data receivedfrom an outside to the first processing unit and the second processingunit, the first processing unit includes a first control part thatprocesses the communication data transferred from the transfer controlunit, the second processing unit includes a second control part thatprocesses the communication data transferred from the transfer controlunit, and the transfer control unit does not set the second processingunit as a transfer destination of the communication data and sets thefirst processing unit to be included in the transfer destination untilthe activation process of the second processing unit is completed andsets at least the second processing unit as the transfer destination ofthe communication data when the activation process of the secondprocessing unit is completed.

A calculation method according to a second aspect of the presentinvention is a calculation method executed by an electronic controldevice including a first processing unit, a second processing unit, anda transfer control unit. The second processing unit requires a longertime for an activation process than the first processing unit, thetransfer control unit is capable of transferring communication datareceived from an outside to the first processing unit and the secondprocessing unit. The method includes: causing a first control part toprocess the communication data transferred from the transfer controlunit; causing a second control part to process the communication datatransferred from the transfer control unit; and causing the transfercontrol unit not to set the second processing unit as a transferdestination of the communication data and to set the first processingunit to be included in the transfer destination until the activationprocess of the second processing unit is completed, and to set at leastthe second processing unit as the transfer destination of thecommunication data when the activation process of the second processingunit is completed.

Advantageous Effects of Invention

According to the present invention, the received communication data canbe processed even before the activation process is completed.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a configuration diagram of an electronic control deviceaccording to a first embodiment.

FIG. 2 is a sequence diagram of the electronic control device accordingto the first embodiment.

FIG. 3 is a flowchart illustrating processing of an internal processingunit.

FIG. 4 is a diagram illustrating an example of transfer information.

FIG. 5 is a diagram illustrating an example of transfer updateinformation.

FIG. 6 is a diagram illustrating an example of internal routeinformation.

FIG. 7 is a diagram illustrating an example of external routeinformation.

FIG. 8 is a configuration diagram of an electronic control deviceaccording to a second embodiment.

FIG. 9 is a sequence diagram of the electronic control device accordingto the second embodiment.

FIG. 10 is a flowchart illustrating processing of an internal processingunit in the second embodiment.

FIG. 11 is a configuration diagram of an electronic control deviceaccording to a third embodiment.

FIG. 12 is a sequence diagram of the electronic control device accordingto the third embodiment.

FIG. 13 is a configuration diagram of an electronic control deviceaccording to a fourth embodiment.

FIG. 14 is a sequence diagram of the electronic control device accordingto the fourth embodiment.

DESCRIPTION OF EMBODIMENTS First Embodiment

Hereinafter, a first embodiment of an electronic control device will bedescribed with reference to FIGS. 1 to 7 .

FIG. 1 is a configuration diagram of an electronic control device 10according to the first embodiment. The electronic control device 10includes a data transfer unit 100 and an external processing unit 200.The data transfer unit 100 includes a transfer control unit 110 and aninternal processing unit 120. The transfer control unit 110 includes acommunication unit 111, a transfer information control unit 112, and atransfer storage unit 113. Transfer information 114 is stored in thetransfer storage unit 113. Furthermore, the internal processing unit 120includes an internal control unit 121, an internal security verificationunit 122, an output destination setting unit 123, and an internalstorage unit 124. The internal storage unit 124 stores internal routeinformation 125, initial information 126, and transfer updateinformation 127.

The external processing unit 200 includes an external control unit 210,an external security verification unit 220, and an external storage unit230. External route information 231 is stored in the external storageunit 230. Note that, hereinafter, the external processing unit 200 maybe referred to as a “first processing unit”, and the external securityverification unit 220 may be referred to as a “first securityverification unit”. In addition, the internal processing unit 120 may bereferred to as a “second processing unit”, and the internal securityverification unit 122 may be referred to as a “second securityverification unit”.

The electronic control device 10 implements the internal control unit121, the output destination setting unit 123, and the external controlunit 210 as follows. That is, the electronic control device 10implements the internal control unit 121, the output destination settingunit 123, and the external control unit 210 by a CPU (not illustrated),which is a central processing unit, developing a program recorded in arewritable storage area (not illustrated) into a random access memory(RAM) (not illustrated) and executing the program. This means that thereis a possibility that the internal control unit 121, the outputdestination setting unit 123, and the external control unit 210 arefalsified by a third party. Therefore, it is necessary to confirm aprogram for implementing these functional blocks before the activationby using the first security verification unit and the second securityverification unit.

The electronic control device 10 is connected to communication buses 2,3, and 4 via a plurality of communication ports (not illustrated)included in the transfer control unit 110. In addition, thecommunication bus 2 is connected to a second device 20, thecommunication bus 3 is connected to a third device 30, and thecommunication bus 4 is connected to a fourth device 40. Hereinafter, thesecond device 20, the third device 30, and the fourth device 40 may becollectively referred to as “each device”.

Here, before describing each functional configuration of the electroniccontrol device 10, an assumed connection configuration of the electroniccontrol device 10 will be described. The electronic control device 10 isa switch in a data link layer or a network layer, a so-called L2 switchor L3 switch. The second device 20, the third device 30, and the fourthdevice 40 are each an electronic control unit (ECU) or a gateway devicemounted on one certain vehicle. The communication standards of thecommunication buses 2, 3, and 4 are not particularly limited, and forexample, CAN (registered trademark), LIN (registered trademark), IEEE802.3, and the like can be used. The communication bus may be connectednot only to the second device 20 but also to other electronic controldevices to construct a bus type or a star type network. In the followingdescription, as an example, it is assumed that IEEE 802.3 is used forthe communication buses 2, 3, and 4.

In the present embodiment, a digital signal output from each device tothe communication bus is referred to as “communication data”. Although aspecific name of the communication data varies depending on acommunication protocol, for example, a frame, a datagram, a packet, orthe like corresponds to the communication data.

Next, each function of the electronic control device 10 illustrated inFIG. 1 will be described. The electronic control device 10 has afunction of transferring the communication data transmitted from thesecond device 20, the third device 30, and the fourth device 40 to anappropriate device. As described below, which of the transfer controlunit 110, the internal processing unit 120, and the external processingunit 200 serves a main role in the transfer of the communication datadepends on a situation and the content of the communication data.

The transfer control unit 110 includes the communication unit 111, thetransfer information control unit 112, and the transfer storage unit113. The transfer control unit 110 transfers the communication datareceived at a certain communication port to another communication port.However, the communication port of the transfer destination may bedetermined by the transfer control unit 110 or may be determined by theinternal processing unit 120 or the external processing unit 200. Thecommunication unit 111 and the transfer information control unit 112 areconfigured by a hardware circuit, and there is no risk of falsification.Unlike the internal processing unit 120 and the external processing unit200, it is not necessary to confirm the safety of the communication unit111 and the transfer information control unit 112 at the time ofactivation.

The communication unit 111 transmits and receives communication datafrom the second device 20, the third device 30, the fourth device 40,the internal processing unit 120, and the external processing unit 200.The transfer destination of the received communication data isinstructed from the transfer information control unit 112. The transferinformation control unit 112 determines the transfer destination of thecommunication data received by the communication unit 111 with referenceto the transfer information 114, and gives an instruction on thetransfer destination of the received communication data to thecommunication unit 111. The transfer storage unit 113 is a volatile ornonvolatile storage area.

The transfer information 114 stores data regarding the transferdestination of the received communication data. As will be describedlater, the transfer information 114 is rewritten by the outputdestination setting unit 123 of the internal processing unit 120. Thetransfer destinations in the present embodiment include the internalprocessing unit 120, the external processing unit 200, the second device20, the third device 30, and the fourth device 40. A data structure ofthe transfer information 114 will be described later with reference toFIG. 4 .

The internal processing unit 120 has a function of rewriting thetransfer destination of the received communication data. For example,the internal processing unit 120 is mounted on an internal processor ofthe switch. The internal control unit 121 and the output destinationsetting unit 123 are implemented by the CPU developing a program storedin a nonvolatile storage area, for example, the internal storage unit124 in the RAM and executing the program. The internal securityverification unit 122 is implemented by a hardware circuit, or isimplemented by reading a program stored in a non-rewritable area such asa ROM or an OTP (One Time Program) area into the RAM.

The internal control unit 121 rewrites the transfer destinationdescribed in the communication header of the received communication dataon the basis of the internal route information 125, and transmits thecommunication data to the transfer control unit 110.

The internal security verification unit 122 has a function of confirmingthat the programs and data stored in the internal processing unit 120are not falsified. Note that the programs and data of the internalprocessing unit 120 are used after the presence or absence offalsification is confirmed by the internal security verification unit122 before the program is activated or before the data is read, and thesafety is confirmed. For example, the internal security verificationunit 122 calculates the hash value of the program for implementing theinternal control unit 121, and determines that there is no falsificationin a case where the signature value matches a value recorded in advance,and determines that there is falsification in a case where the hashvalue does not match the value recorded in advance. However, the hashvalue created in advance needs to be stored in a read-only memory suchas a hardware security module (HSM).

The output destination setting unit 123 performs writing on the transferstorage unit 113 of the transfer control unit 110, and creates andupdates the transfer information 114. The initial information 126 andthe transfer update information 127 stored in the internal storage unit124 are used to create and update the transfer information 114. Theinternal storage unit 124 is a volatile or nonvolatile storage area.When the internal storage unit 124 is volatile, the internal routeinformation 125, the initial information 126, and the transfer updateinformation 127 stored in a nonvolatile storage area (not illustrated)are read into the internal storage unit 124 when the electronic controldevice 10 is activated.

The internal route information 125 is used by the internal control unit121 to rewrite the transfer destination of the communication data. Theinitial information 126 is information regarding the transferdestination of the communication data. The initial information 126 iswritten in the transfer storage unit 113 through the output destinationsetting unit 123. As a result, the transfer information 114 is createdas described later. The initial information 126 has the same datastructure as the transfer information 114. The transfer updateinformation 127 stores data necessary for rewriting the transferdestination of the communication data, and is used to update thetransfer information 114.

Similarly to the internal processing unit 120, the external processingunit 200 rewrites the transfer destination of the received communicationdata. The external processing unit 200 is mounted on a microcomputer andhas a small size compared to the internal processing unit 120.Therefore, although the external processing unit 200 has a lowerprocessing capability than the internal processing unit 120, theactivation process is completed earlier than the internal processingunit 120. On the basis of the external route information 231, theexternal control unit 210 rewrites the transfer destination described inthe communication header of the received communication data, andtransmits the communication data to the transfer control unit 110.

The external security verification unit 220 has a function similar tothat of the internal security verification unit 122, and has a functionof confirming that the programs and data stored in the externalprocessing unit 200 are not falsified. Note that, hereinafter, theexternal security verification unit 220 and the internal securityverification unit 122 confirming that the program and data are notfalsified and making the program and data available is also referred toas “secure boot”. The external route information 231 is informationnecessary for rewriting the transfer destination of the receivedcommunication data. The external route information 231 has a structuresimilar to as that of the internal route information 125.

FIG. 2 is a sequence diagram for explaining a flow of the processing ofthe electronic control device 10. The process illustrated in FIG. 2 isexecuted by the electronic control device 10. The activation process ofthe internal processing unit 120 is divided into two stages, and thefirst half is referred to as a “first activation process” and the secondhalf is referred to as a “second activation process”. First, in stepS300, the power supply of the electronic control device 10 is turned on,and electricity is supplied to the internal processing unit 120, theexternal processing unit 200, and the transfer control unit 110. At theleft end of FIG. 2 , a time-series change in a processing capability ofthe electronic control device 10 processing the communication data isillustrated. This processing capability indicates that the processingcapability increases when a width in a lateral direction in the drawingincreases.

In step S301, the external security verification unit 220 verifieswhether the program and data of the external processing unit 200 isfalsified. When the verification by the external security verificationunit 220 is completed, the external processing unit 200 proceeds to stepS302 and activates the program to transition to a state where thetransfer process of the communication data can be performed, that is, arouting reception state. In the routing reception state, when thecommunication data is received, the external control unit 210 rewritesthe transfer destination of the communication header on the basis of theexternal route information 231 and transmits the communication data tothe communication unit 111 of the transfer control unit 110, therebytransferring the communication data to another device.

In step S303 which is the first activation process of the internalprocessing unit 120, the internal security verification unit 122performs safety-verification on not the entire internal processing unit120 but the program and data relevant to the setting of the transferinformation 114 of the transfer control unit 110, and activation isperformed. Specifically, the secure boot is performed on the outputdestination setting unit 123 and the initial information 126 of theinternal processing unit 120. When the output destination setting unit123 and the initial information 126 become available, the internalprocessing unit 120 proceeds to step S304.

In step S304, the output destination setting unit 123 writes the initialinformation 126 in the transfer storage unit 113 of the transfer controlunit 110 to generate the transfer information 114. In the transferinformation 114 generated in step S304, the external processing unit 200is set as one transfer destination, and the communication data receivedby the transfer control unit 110 can be transferred to the externalprocessing unit 200. Since the external processing unit 200 is in therouting reception state, the external processing unit operates a routingfunction. In the transfer information 114 generated in step S304, theinternal processing unit 120 is not included in the transferdestination.

When the writing to the transfer storage unit 113 by the outputdestination setting unit 123 ends, the internal processing unit 120proceeds to step S305. In step S305 which is the second activationprocess of the internal processing unit 120, the internal securityverification unit 122 performs the secure boot on the remaining programsand data which are not subjected to the secure boot in step S303described above. Specifically, the internal security verification unit122 performs the secure boot on the internal control unit 121, theinternal route information 125, and the transfer update information 127.When the secure boot is completed, the process proceeds to step S306.

In step S306, the output destination setting unit 123 of the internalprocessing unit 120 updates the transfer information 114 by writing thetransfer update information 127 in the transfer storage unit 113. Withthis update, the internal processing unit 120 is included in thetransfer destination of the transfer information 114. In step S307, theinternal processing unit 120 transitions to a state where the transferprocess of the communication data can be performed, that is, the routingreception state, and transfers the communication data received from thetransfer control unit 110 according to the transfer information 114.

The time-series change in the processing capability of the electroniccontrol device 10 illustrated in the left end of FIG. 2 will bedescribed. Since the communication data cannot be processed until stepS304 is completed, the processing capability is zero. When step S304 iscompleted, the transfer control unit 110 and the external processingunit 200 can process the communication data. When step S306 iscompleted, the transfer control unit 110, the external processing unit200, and the internal processing unit 120 can process the communicationdata, so that the processing capability is enhanced.

FIG. 3 is a flowchart illustrating a detailed processing procedure ofthe internal processing unit 120. When power supply is input to theinternal processing unit 120, step S400 is started. In step S400, theinternal security verification unit 122 executes the secure boot andconfirms that the function related to the writing to the transferinformation 114 of the transfer control unit 110 is not falsified.Specifically, the secure boot is performed on the output destinationsetting unit 123 and the initial information 126 of the internalprocessing unit 120.

In subsequent step S401, the internal processing unit 120 confirmswhether or not the secure boot performed in step S400 is successful, andactivation is possible. In a case where it is determined that the secureboot fails, the internal processing unit 120 proceeds to step S402,stops the processing, and ends the process of FIG. 3 . In a case whereit is determined that the secure boot is successful, the internalprocessing unit 120 proceeds to step S403.

In step S403, the internal processing unit 120 confirms whether thesecure boot of the external processing unit is completed and theexternal processing unit 200 is already in the routing reception state.Note that this step may be skipped depending on the situation, forexample, in a case where it is known that the secure boot of theexternal processing unit 200 is completed in a shorter time than thesecure boot of the internal processing unit 120 is completed, or in acase where it is desired to activate the transfer function in a shortertime. In a case where it is determined that the external processing unit200 is in the routing reception state, the internal processing unit 120proceeds to step S404. In a case where it is determined that theexternal processing unit 200 is not in the routing reception state, theinternal processing unit 120 proceeds to step S402, stops theprocessing, and ends the process of FIG. 3 .

In step S404, the output destination setting unit 123 writes theinformation of the initial information 126 in the transfer storage unit113 of the transfer control unit 110 to create the transfer information114. When the creation of the transfer information 114 is completed, thecommunication data received by the transfer control unit 110 can betransferred to the external processing unit 200. Therefore, the transferfunction is already in operation when step S404 is completed.

In subsequent step S405, the internal security verification unit 122executes the secure boot on the remaining programs and data, which arenot verified for safety in step S400, of the internal processing unit120. Specifically, the secure boot is performed on the internal controlunit 121, the internal route information 125, and the transfer updateinformation 127.

In subsequent step S406, the internal processing unit 120 confirmswhether or not the secure boot performed in step S405 is successful. Ina case where it is determined that the secure boot is successful, theinternal processing unit 120 proceeds to step S407, and in a case whereit is determined that the secure boot fails, the internal processingunit proceeds to step S402, stops the processing, and ends the processof FIG. 3 .

In step S407, the output destination setting unit 123 updates thetransfer information 114 when the output destination setting unit 123writes the information of the transfer update information 127 in thetransfer storage unit 113 of the transfer control unit 110. Insubsequent step S408, the internal processing unit 120 enters therouting reception state, the communication data received by the transfercontrol unit 110 can be processed, and the process illustrated in FIG. 3ends.

FIG. 4 is a diagram illustrating an example of the transfer information114. FIG. 4(a) illustrates the transfer information 114 created by theprocess of step S304 of FIG. 2 or step S404 of FIG. 3 . FIG. 4(b)illustrates the transfer information 114 created in step S306 of FIG. 2or step S407 of FIG. 3 . Hereinafter, the transfer information 114illustrated in FIG. 4(a) is referred to as the “before-update” transferinformation 114, and the transfer information 114 illustrated in FIG.4(b) is referred to as the “after-update” transfer information 114.

The transfer information 114 includes a MAC address 1130 and a transferdestination 1131. The MAC address 1130 is used to identify the receivedcommunication data and investigate the registered transfer destination.In the transfer destination 1131, the transfer destination of thereceived communication data is described. For example, the port numbersconnected to the internal processing unit 120, the external processingunit 200, the second device 20, and the third device 30 are described.

The communication data received before the update of the transferinformation 114 is not transferred to the internal processing unit 120but transferred to any device or the external processing unit 200. Thisis because the activation of the transfer function of the internalprocessing unit 120 is not completed, and thus the before-updatetransfer information 114 is created with the intention of avoidingtransfer to the internal processing unit 120. In the communication datareceived by the transfer control unit 110 from the internal processingunit 120 and the external processing unit 200, the transfer destinationMAC address included in the communication header is rewritten.Therefore, the transfer information control unit 112 refers to thetransfer information 114 again to search for the transfer destination,and transmits the communication data to the corresponding transferdestination.

Although FIG. 4 illustrates the example in which the MAC address 1130 isused to identify the communication data, other values may be used aslong as the transfer destination of the communication data can bedetermined. For example, the transfer destination may be determined byusing a part of the value of the MAC address 1130 or using the IPaddress or a part thereof.

FIG. 5 is a diagram illustrating an example of the transfer updateinformation 127. The transfer update information 127 is an updatedportion of the transfer information 114, for example, a differencebetween FIGS. 4(a) and 4(b). The output destination setting unit 123refers to the transfer information 114 stored in the transfer storageunit 113, and in a case where the MAC addresses of the transfer updateinformation 127 matches the transfer information, updates theinformation stored in the transfer destination 1131 to the informationof the transfer destination 1261. In the example of FIG. 5 , thetransfer destination of the MAC address “00:01:02:03:05” is updated tothe internal processing unit 120. In the after-update transferinformation 114 illustrated in FIG. 4(b), the processing is performedafter the update in a distributed manner by the external processing unit200 and the internal processing unit 120 in order to distribute theprocessing load of the communication data. However, after the update,the external processing unit 200 may not perform the transfer process ofthe communication data, and the internal processing unit 120 may processall the communication data.

FIG. 6 is a diagram illustrating an example of the internal routeinformation 125. The internal route information 125 includes an IPaddress 1240 and a transfer MAC address 1241. The internal control unit121 refers to the internal route information 125 to search for the MACaddress of the transfer destination from the IP address included in theheader of the received communication data, rewrites the headerinformation to the searched MAC address, and transmits the communicationdata to the transfer control unit 110. For example, in a case where thecommunication data having a MAC address of “00:01:02:03:04:05” and an IPaddress of “255.255.1.3” is received, the transfer destination MACaddress is searched for from the database, and the communication headeris rewritten from “00:01:02:03:04:05” to “1A:2B:3C:4D:5E:6F”.

FIG. 7 is a diagram illustrating an example of the external routeinformation 231. The data structure of the external route information231 is the same as that of the internal route information 125 in FIG. 6. Since the external processing unit 200 needs to rewrite the transferdestination MAC address of the communication data also for thecommunication data received before the internal processing unit 120operates, the external route information 231 has a larger data amountthan the internal route information 125.

According to the first embodiment described above, the followingoperational effects can be obtained.

(1) The electronic control device 10 includes the external processingunit 200 (first processing unit), the internal processing unit 120(second processing unit), and the transfer control unit 110. Theinternal processing unit 120 requires a longer time for the activationprocess than the external processing unit 200. The transfer control unit110 can transfer the communication data received from the outside to theexternal processing unit 200 and the internal processing unit 120. Asillustrated in FIG. 4(a), the transfer control unit 110 does not set theinternal processing unit 120 as the transfer destination of the data butincludes the external processing unit 200 as the transfer destinationuntil the activation process of the internal processing unit 120 iscompleted, and sets at least the internal processing unit 120 as thetransfer destination of the data when the activation process of theinternal processing unit 120 is completed as illustrated in FIG. 4(b).Therefore, the communication data can be processed even before theinternal processing unit 120 completes the activation process, and theprocessing capability for the communication data received at the time ofactivation is secured. In addition, when the activation process of theinternal processing unit 120 is completed, the communication data isprocessed by using the internal processing unit 120, so that theprocessing capability is improved.

For example, it is also conceivable that the transfer control unit 110does not process the communication data at all until the entireactivation process of the internal processing unit 120 and the externalprocessing unit 200 is completed. In that case, the processingcapability is zero until the entire activation process is completed. Onthe other hand, in the present embodiment, since the communication datais processed by the transfer control unit 110 and the internalprocessing unit 120 even when the activation process of the externalprocessing unit 200 is not completed, the processing can be started fromthe activation even though the processing capability is low. That is, inthe present embodiment, a period in which the processing capability iszero can be shortened.

(2) The transfer control unit 110 includes the transfer storage unit 113that stores the transfer information 114 which is correspondenceinformation between an identifier of data and a transfer destination ofdata. The transfer control unit 110 refers to the transfer information114 to determine the transfer destination of the data. In the transfercontrol unit 110, the transfer destination of the communication data ischanged when the internal processing unit 120 rewrites the transferinformation 114.

(3) When the activation process of the internal processing unit 120 iscompleted, the transfer control unit 110 transfers the data to one ofthe transfer destinations including the external processing unit 200 andthe internal processing unit 120 with reference to the transferinformation 114. Therefore, when the activation process of the internalprocessing unit 120 is completed, the transfer process of thecommunication data is executed using not only the external processingunit 200 but also the internal processing unit 120, so that theprocessing becomes faster.

(4) The internal processing unit 120 includes the internal securityverification unit 122 (second security verification unit) that detectsfalsification. The internal processing unit 120 performs, as a part ofthe activation process, the detection of the falsification of at leastone component configuring the internal processing unit 120 except theinternal security verification unit 122 by using the internal securityverification unit 122.

(5) The transfer control unit 110 includes the transfer storage unit 113that stores the transfer information 114 which is correspondenceinformation between an identifier of data and a transfer destination ofdata. The transfer control unit 110 refers to the transfer information114 to determine the transfer destination of the data. The internalprocessing unit 120 includes the internal security verification unit 122(second security verification unit) that detects falsification. Theactivation process of the internal processing unit 120 includes thefirst activation process in S303 of FIG. 2 and the second activationprocess in S305 of FIG. 2 . In the first activation process, theinternal security verification unit 122 detects falsification of aprogram for implementing the output destination setting unit 123 whichrewrites the transfer information 114 and the initial information 126which is information indicating that the internal processing unit 120 isnot the transfer destination of data, and the output destination settingunit 123 writes the initial information 126 in the transfer storage unit113. Therefore, it is possible to create the safe transfer information114 confirmed to be not falsified by using the internal securityverification unit 122.

First Modification

In the first embodiment described above, the data transfer unit 100 hasbeen described as a configuration in which the transfer control unit 110and the internal processing unit 120 are independent of each other.However, the transfer control unit 110 and the internal processing unit120 may not be explicitly separated.

Second Modification

In the first embodiment described above, both the internal processingunit 120 and the external processing unit 200 perform the secure boot.However, at least one of the internal processing unit 120 and theexternal processing unit 200 may not perform the secure boot. A casewhere the secure boot does not need to be performed is, for example, acase where a program or data is stored in a read-only memory, a casewhere it is not necessary to consider a possibility of falsifying, orthe like. Even in a case where the secure boot is not performed, theconfiguration of the present embodiment is effective in a case where theactivation of the external processing unit 200 takes a longer time thanthat of the internal processing unit 120 due to, for example, a largedata size of the program or data. That is, until the activation processof the external processing unit 200 taking a long time for theactivation process is completed, the external processing unit 200 is oneof the transfer destinations from the transfer control unit 110, andwhen the activation process of the external processing unit 200 iscompleted, the external processing unit 200 and the internal processingunit 120 are included in the transfer destinations from the transfercontrol unit 110, so that the processing of the communication data canbe started before the activation process is completed.

Third Modification

In the first embodiment described above, the output destination settingunit 123 of the internal processing unit 120 performs writing on thetransfer storage unit 113 of the transfer control unit 110. However, theinternal processing unit 120 may transmit a write command to thetransfer control unit 110, and the transfer control unit 110 may performwriting to the transfer storage unit 113. In this case, the initialinformation 126 and the transfer update information 127 are provided inthe transfer control unit 110. The internal processing unit 120transmits a rewrite command to the transfer control unit 110, and thetransfer control unit 110 rewrites the transfer information 114 byitself.

Fourth Modification

In the first embodiment described above, when the activation process ofthe internal processing unit 120 is completed, the transfer information114 is rewritten such that both the internal processing unit 120 and theexternal processing unit 200 are included in the transfer destination.However, when the activation process of the internal processing unit 120is completed, the transfer information 114 may be rewritten such thatthe internal processing unit 120 is included in the transferdestination, but the external processing unit 200 is not included in thetransfer destination. In this case, for example, when the activationprocess of the internal processing unit 120 is completed, the transferinformation 114 is obtained by rewriting “external processing unit” inthe third line of FIG. 4(b) to “internal processing unit”. According tothe present modification, when the activation process of the internalprocessing unit 120 is completed, the external processing unit 200 doesnot perform the transfer process of the communication data, so that theexternal processing unit 200 can execute another process.

Fifth Modification

In the first embodiment described above, the internal control unit 121and the output destination setting unit 123 are implemented by a CPU(not illustrated) executing a program. However, the internal controlunit 121 and the output destination setting unit 123 may be implementedby using a field programmable gate array (FPGA) which is a rewritablelogic circuit. In a case where configuration data to be written in theFPGA is stored in a rewritable storage area, the internal securityverification unit 122 detects falsification of the configuration data asa process of the secure boot. Similarly to the program, the internalsecurity verification unit 122 calculates a signature value of theconfiguration data, and determines whether or not the configuration datais falsified on the basis of whether or not the signature value matchesa value recorded in advance.

Note that the program and the configuration data are similar in terms ofprogram codes for implementing the above-described functional blocksalthough the objects to be read are different. Hereinafter, the programand the configuration data are collectively referred to as “programimplementation data”. According to the fifth modification, even in acase where the FPGA is included in the configuration of the electroniccontrol device 10, it is possible to obtain operational effects similarto those of the first embodiment.

Sixth Modification

In the first embodiment described above, a part of the communicationdata can be processed only by the transfer control unit 110. Forexample, the processing of the communication data having two MACaddresses from the top illustrated in FIG. 4(a) is completed only by thetransfer control unit 110 without being transferred to the internalprocessing unit 120 or the external processing unit 200. However, thetransfer control unit 110 may always transfer the communication data tothe internal processing unit 120 or the external processing unit 200instead of completing the processing only by the transfer control unit110.

Seventh Modification

The internal control unit 121 and the external control unit 210 rewritethe header information of the received communication data. However, atleast one of the internal control unit 121 and the external control unit210 may not rewrite the header information of the received communicationdata. In this case, the internal control unit 121 and the externalcontrol unit 210 perform some processes using the communication data.This process is, for example, a process of determining whether or notthe communication data conforms to a predetermined rule and discardingthe communication data when the communication data does not conform tothe predetermined rule.

Eighth Modification

The locations of the internal processing unit 120 and the externalprocessing unit 200 may be switched. That is, the external processingunit 200 may be included in the data transfer unit 100, and the internalprocessing unit 120 may exist outside the data transfer unit 100.

Second Embodiment

A second embodiment of the electronic control device will be describedwith reference to FIGS. 8 to 10 . In the following description, the samecomponents as those of the first embodiment are denoted by the samereference numerals, and differences will be mainly described. The pointsnot particularly described are the same as those in the firstembodiment. The present embodiment is different from the firstembodiment mainly in that there is no possibility of falsification ofsome programs.

FIG. 8 is a configuration diagram of an electronic control device 10Aaccording to the second embodiment. The same components as those of theelectronic control device in the first embodiment are denoted by thesame reference numerals, and the description thereof is omitted. In thepresent embodiment, the program for implementing the output destinationsetting unit 123 of the internal processing unit 120 and the initialinformation 126 are stored in a non-rewritable memory area 129 such asan HSM or a one time program (OTP) area. That is, a program forimplementing the function necessary for writing to the transfer storageunit 113 of the transfer control unit 110 and information to be writtenin the transfer storage unit 113 are objects to be stored in thenon-rewritable area.

FIG. 9 is a sequence diagram illustrating the operation of theelectronic control device 10A in the second embodiment. The processessimilar to those in FIG. are denoted by the same reference numerals, andthe description thereof is omitted. As compared with the sequencediagram of FIG. 2 , the process immediately after the operation of theinternal processing unit 120 is started, that is, the method ofactivating the function for writing to the transfer storage unit 113 ofthe transfer control unit 110 is different.

In step S900, the internal processing unit 120 performs a program forwriting to the transfer storage unit 113, that is, the activation of theoutput destination setting unit 123 and the reading of the initialinformation 126. In the present embodiment, since the program forimplementing the output destination setting unit 123 and the initialinformation 126 are stored in a non-writable area, and there is no riskof falsification, the verification by the internal security verificationunit 122 can be omitted. Since subsequent processing is similar to thatof the first embodiment, the description thereof is omitted.

FIG. 10 is a flowchart illustrating processing of the internalprocessing unit 120 in the second embodiment. The processes similar tothe steps illustrated in FIG. 3 are denoted by the same referencenumerals, and the description thereof is omitted. Compared with FIG. 3 ,steps S400 and S401 are replaced with step S900.

In step S1000, since the program related to the writing of the transferinformation 114 is stored in the HSM, and there is no risk offalsification, the portion related to the output destination is read andactivated without performing the secure boot. Specifically, the outputdestination setting unit 123 and the initial information 126 are called.

According to the second embodiment described above, the followingoperational effects can be obtained.

(6) The transfer control unit 110 of the electronic control device 10Aincludes the transfer storage unit 113 that stores transfer information114 which is correspondence information between an identifier of dataand a transfer destination of data. The transfer control unit 110 refersto the transfer information 114 to determine the transfer destination ofthe data. The activation process of the internal processing unit 120includes the first activation process and the second activation process.In the first activation process, the internal security verification unit122 read, from a read-only area, a program code for implementing theoutput destination setting unit 123 which rewrites the transferinformation 114 and the initial information 126 which is informationindicating that the internal processing unit 120 is not the transferdestination of the data, and the output destination setting unit 123writes the initial information 126 in the transfer storage unit 113.

Therefore, in the present embodiment, since the internal securityverification unit 122 does not require the secure boot of the outputdestination setting unit 123 and the initial information 126, the firstprocess can be completed earlier than in the first embodiment.

Third Embodiment

A third embodiment of the electronic control device will be describedwith reference to FIGS. 11 and 12 . In the following description, thesame components as those of the first embodiment are denoted by the samereference numerals, and differences will be mainly described. The pointsnot particularly described are the same as those in the firstembodiment. The present embodiment is different from the firstembodiment mainly in that the transfer information is rewritten at thetime of ending.

FIG. 11 is a configuration diagram of an electronic control device 10Baccording to the third embodiment. The same components as those of theelectronic control device in the first embodiment are denoted by thesame reference numerals, and the description thereof is omitted. In thepresent embodiment, the internal processing unit 120 further includes anend processing unit 128. In addition, the processing of the internalsecurity verification unit 122 and the output destination setting unit123 is different from that of the first embodiment. In the presentembodiment, the transfer storage unit 113 is a nonvolatile storagedevice, for example, a flash memory, a phase change memory, a magneticmemory, or the like. Therefore, when power is supplied to the electroniccontrol device 10B, the information stored when the power supply isstopped remains as it is in the transfer storage unit 113.

In the present embodiment, the electronic control device 10B receives anoperation stop command signal before the power supply from the outsideis stopped. When the operation stop command signal is input, the outputdestination setting unit 123 writes the initial information 126 in thetransfer storage unit 113, and rewrites the transfer information 114such that the internal processing unit 120 is not included in thetransfer destination as illustrated in FIG. 4(a). After this rewriting,the power supply to the electronic control device 10B is stopped.

In the electronic control device 10B, when power is supplied, each ofthe internal processing unit 120 and the external processing unit 200starts the secure boot. However, the internal security verification unit122 of the internal processing unit 120 sets the internal control unit121, the output destination setting unit 123, the internal routeinformation 125, and the transfer update information 127 as the targetsof the secure boot. That is, the initial information 126 is not thetarget of the secure boot at the time of activation. The initialinformation 126 is verified at a timing when the processing load afteractivation is low. When the secure boot is completed, the internalprocessing unit 120 writes the transfer update information 127 in thetransfer storage unit 113 by using the output destination setting unit123, thereby rewriting the transfer information 114 to the transferdestination including the internal processing unit 120 as illustrated inFIG. 4(b). When the rewriting is completed, the internal processing unit120 transitions to the routing reception state.

FIG. 12 is a sequence diagram illustrating the operation of theelectronic control device 10B in the third embodiment. The processessimilar to those in the first embodiment and the second embodiment aredenoted by the same reference numerals, and the description thereof isomitted. In the upper part of the sequence diagram illustrated in FIG.12 , a certain time has elapsed since the activation of the electroniccontrol device 10B, and both the internal processing unit 120 and theexternal processing unit 200 transition to the routing reception state.Note that the transfer information 114 at this time includes theinternal processing unit 120 as the transfer destination as illustratedin FIG. 4(b).

In step S390, when the operation stop command signal is input, theoutput destination setting unit 123 of the internal processing unit 120performs the following processing. That is, the output destinationsetting unit 123 reads the initial information 126 from the internalstorage unit 124 in step S910, and writes the initial information in thetransfer storage unit 113 of the transfer control unit 110 in step S314.After completion of the writing, the power supply to the internalprocessing unit 120 ends. Thereafter, in step S300, power is supplied tothe internal processing unit 120. Similarly to the first embodiment, theexternal processing unit 200 performs the secure boot in step S301, andwhen the secure boot is completed, the external processing unittransitions to the routing reception state (step S302).

In a stage where step S301 is completed, the process corresponding toS304 in the first embodiment is completed by rewriting in step S314immediately before the power supply is turned off. Therefore, when theexternal processing unit 200 transitions to the routing reception statein step S302, a routing process using the external processing unit 200becomes possible.

According to the third embodiment described above, the followingoperational effects can be obtained.

(7) The transfer storage unit 113 is a nonvolatile storage area. The endprocessing unit 128 is provided which, as the ending process of theelectronic control device 10B, rewrites the transfer information 114such that the internal processing unit 120 is not included in thetransfer destination. Therefore, the electronic control device 10B canstart the processing of the transfer data earlier than in the firstembodiment and the second embodiment.

Fourth Embodiment

A fourth embodiment of the electronic control device will be describedwith reference to FIGS. 13 and 14 . In the following description, thesame components as those of the first embodiment are denoted by the samereference numerals, and differences will be mainly described. The pointsnot particularly described are the same as those in the firstembodiment. The present embodiment is different from the firstembodiment mainly in that the present embodiment is applied even to acase where either the internal processing unit or the externalprocessing unit completes the activation process first.

FIG. 13 is a configuration diagram of an electronic control device 10Cin the fourth embodiment. The same components as those of the electroniccontrol device 10 in the first embodiment are denoted by the samereference numerals, and the description thereof is omitted. The internalprocessing unit 120 in the present embodiment further includes aninternal determination unit 961 in addition to the configuration in thefirst embodiment. Further, the internal storage unit 124 stores internalinitial information 951 instead of the initial information 126. Theexternal processing unit 200 in the present embodiment includes anexternal determination unit 962 and an external output destinationsetting unit 963 in addition to the configuration in the firstembodiment. External initial information 952 is stored in the externalstorage unit 230.

The internal security verification unit 122 of the internal processingunit 120 performs the secure boot of the internal control unit 121, theoutput destination setting unit 123, the internal determination unit961, the internal route information 125, and the internal initialinformation 951 at the time of activation. In the first embodiment, theinternal processing unit 120 performs the secure boot in two stages, butin the present embodiment, all the secure boot is processed at once.

The external security verification unit 220 of the external processingunit 200 performs the secure boot of the external control unit 210, theexternal determination unit 962, the external output destination settingunit 963, the external route information 231, and the external initialinformation 952 at the time of activation.

The internal initial information 951 is data related to the transferdestination of the received communication data, the internal processingunit 120 is set to at least one of the transfer destinations, and theexternal processing unit 200 is not included in the transferdestination. The external initial information 952 is data related to thetransfer destination of the received communication data, the externalprocessing unit 200 is set to at least one of the transfer destinations,and the internal processing unit 120 is not included in the transferdestination. The external initial information 952 is, for example, asillustrated in FIG. 4(a).

When the secure boot of the internal processing unit 120 is completed,the internal determination unit 961 performs the following operation.The internal determination unit 961 determines whether or not the secureboot of the external processing unit 200 is completed. Whether or notthe secure boot of the external processing unit 200 is completed may bedetermined, for example, by the internal determination unit 961 readingthe contents of the transfer storage unit 113, or the determination maybe implemented by the internal processing unit 120 and the externalprocessing unit 200 mutually sending a signal indicating that the secureboot is completed.

When it is determined that the secure boot of the external processingunit 200 is not completed, the internal determination unit 961 writesthe internal initial information 951 in the transfer storage unit 113 byusing the output destination setting unit 123, and creates the transferinformation 114 including the internal processing unit 120 as thetransfer destination. When it is determined that the secure boot of theexternal processing unit 200 is completed, the internal determinationunit 961 uses the output destination setting unit 123 to perform writingon the transfer storage unit 113 such that the transfer destination ofthe transfer information 114 is rewritten to include both the internalprocessing unit 120 and the external processing unit 200, for example,as in the state illustrated in FIG. 4(b).

When the secure boot of the external processing unit 200 is completed,the external determination unit 962 performs the following operation.The external determination unit 962 determines whether or not the secureboot of the internal processing unit 120 is completed. Thisdetermination can be implemented by a method similar to that of theinternal determination unit 961. When it is determined that the secureboot of the internal processing unit 120 is not completed, the externaldetermination unit 962 writes the external initial information 952 inthe transfer storage unit 113 by using the external output destinationsetting unit 963, and creates the transfer information 114 including theexternal processing unit 200 as the transfer destination. When it isdetermined that the secure boot of the internal processing unit 120 iscompleted, the external determination unit 962 uses the external outputdestination setting unit 963 to perform writing on the transfer storageunit 113 such that the transfer destination of the transfer information114 is rewritten to include both the internal processing unit 120 andthe external processing unit 200, for example, as in the stateillustrated in FIG. 4(b).

FIG. 14 is a sequence diagram for explaining a flow of processing of theelectronic control device 10C in the fourth embodiment. Steps S911 andS921 are simultaneously started. In step S911, the external securityverification unit 220 starts the secure boot. In step S921, the internalsecurity verification unit 122 starts the secure boot. When the secureboot by the internal security verification unit 122 is completed, theinternal determination unit 961 starts an operation, and determineswhether or not the secure boot by the external processing unit 200 iscompleted. In the example illustrated in FIG. 14 , the secure boot bythe external processing unit 200 is not completed, and thus the internaldetermination unit 961 writes the internal initial information 951 inthe transfer storage unit 113 in step S931, and transitions to therouting reception state in step S922.

When the secure boot 911 is completed, the external processing unit 200determines that the secure boot of the internal processing unit 120 isalready completed by the external determination unit 962. Then, theexternal determination unit 962 rewrites the transfer information 114 instep S932, and the external processing unit 200 transitions to therouting reception state in step S912.

According to the fourth embodiment described above, even in a case whereeither the internal processing unit 120 or the external processing unit200 is activated first, it is possible to start the processing of thetransfer data using the processing unit which is activated first.

In the present embodiment, the information described in the transferinformation 114 changes depending on which of the internal processingunit 120 and the external processing unit 200 is activated first.However, the name of the configuration may be changed without changingthe information described in the transfer information 114. For example,the internal processing unit 120 and the external processing unit 200are temporarily read as a first calculation unit and a secondcalculation unit, and information to be written in the transferinformation 114 is similar to that of the first embodiment. That is, thetransfer destination of the transfer information 114 created firstincludes the external processing unit 200 but does not include theinternal processing unit 120 as illustrated in FIG. 4(a).

The calculation unit which is activated first among the firstcalculation unit and the second calculation unit is referred to as theexternal processing unit 200, and the calculation unit which isactivated later is referred to as the internal processing unit 120. Theoperation in the present embodiment can be expressed by changing thename in this manner. That is, the present embodiment can also beexpressed as follows.

(8) In the electronic control device 10C, each of the internalprocessing unit 120 and the external processing unit 200 is either thefirst calculation unit or the second calculation unit. The electroniccontrol device 10C includes determination units, that is, the internaldetermination unit 961 and the external determination unit 962 whichrewrite the transfer information 114 with one calculation unit, in whichthe activation process is completed first, among the first calculationunit and the second calculation unit set as the external processing unit200 and rewrite the transfer information 114 with another calculationunit, in which the activation process is completed later, among thefirst calculation unit and the second calculation unit set as theinternal processing unit 120. Therefore, even in a case where either theinternal processing unit 120 or the external processing unit 200 isactivated first, it is possible to start the processing of the transferdata using the processing unit which is activated first.

In the above-described embodiments and modifications, the configurationof the functional block is merely an example. Some functionalconfigurations illustrated as separate functional blocks may beintegrally configured, or a configuration illustrated in one functionalblock diagram may be divided into two or more functions. In addition,some of the functions of each functional block may be included inanother functional block.

The embodiments and modifications described above may be combined witheach other. Although various embodiments and modifications have beendescribed above, the present invention is not limited to these contents.Other embodiments considered within the scope of the technical idea ofthe present invention are also included within the scope of the presentinvention.

The disclosure of the following priority application is herebyincorporated by reference.

Japanese patent application 2019-208977 (filed on Nov. 19, 2019)

REFERENCE SIGNS LIST

-   10, 10A, 10B electronic control device-   100 data transfer unit-   110 transfer control unit-   111 communication unit-   112 transfer information control unit-   113 transfer storage unit-   114 transfer information-   120 internal processing unit-   121 internal control unit-   122 internal security verification unit-   123 output destination setting unit-   124 internal storage unit-   126 initial information-   127 transfer update information-   128 end processing unit-   129 non-rewritable memory area-   200 external processing unit-   210 external control unit-   220 external security verification unit-   230 external storage unit-   951 internal initial information-   952 external initial information-   961 internal determination unit-   962 external determination unit-   963 external output destination setting unit

1. An electronic control device comprising: a first processing unit; a second processing unit; and a transfer control unit, wherein the second processing unit requires a longer time for an activation process than the first processing unit, the transfer control unit includes a communication unit capable of transferring communication data received from an outside to the first processing unit and the second processing unit, the first processing unit includes a first control part that processes the communication data transferred from the transfer control unit, the second processing unit includes a second control part that processes the communication data transferred from the transfer control unit, and the transfer control unit does not set the second processing unit as a transfer destination of the communication data and sets the first processing unit to be included in the transfer destination until the activation process of the second processing unit is completed and sets at least the second processing unit as the transfer destination of the communication data when the activation process of the second processing unit is completed.
 2. The electronic control device according to claim 1, wherein the transfer control unit further includes a transfer storage unit that stores transfer information which is correspondence information between an identifier of the communication data and the transfer destination of the communication data, the transfer control unit determines the transfer destination of the communication data with reference to the transfer information, and in the transfer control unit, the transfer destination of the communication data is changed when the transfer control unit rewrites the transfer information, or the transfer destination of the communication data is changed when the second processing unit rewrites the transfer information.
 3. The electronic control device according to claim 2, wherein the transfer control unit further includes a transfer storage unit that stores transfer information which is correspondence information between an identifier of the communication data and the transfer destination of the communication data, and the transfer control unit transfers the communication data to any one of the transfer destinations including the first processing unit and the second processing unit with reference to the transfer information when the activation process of the second processing unit is completed.
 4. The electronic control device according to claim 2, wherein the second processing unit further includes an output destination setting unit that rewrites the transfer information of the transfer storage unit such that the second processing unit is included in the transfer destination when the activation process of the second processing unit is completed.
 5. The electronic control device according to claim 2, wherein the transfer storage unit is a nonvolatile storage area, the electronic control device further comprising: an end processing unit that performs, as an ending process of the electronic control device, rewriting of the transfer information such that the second processing unit is not included in the transfer destination.
 6. The electronic control device according to claim 1, wherein the second processing unit includes a second security verification unit that detects falsification, and the second processing unit performs, as a part of the activation process, detection of falsification of at least one component configuring the second processing unit except the second security verification unit by using the second security verification unit.
 7. The electronic control device according to claim 1, wherein the transfer control unit further includes a transfer storage unit that stores transfer information which is correspondence information between an identifier of the communication data and the transfer destination of the communication data, the transfer control unit determines the transfer destination of the communication data with reference to the transfer information, the second processing unit includes a second security verification unit that detects falsification, the activation process of the second processing unit includes a first activation process and a second activation process, and in the first activation process, the second security verification unit detects falsification of program implementation data for implementing an output destination setting unit that rewrites the transfer information and initial information which is information indicating that the second processing unit is not the transfer destination of the communication data, and the output destination setting unit writes the initial information in the transfer storage unit.
 8. The electronic control device according to claim 1, wherein the transfer control unit further includes a transfer storage unit that stores transfer information which is correspondence information between an identifier of the communication data and the transfer destination of the communication data, the transfer control unit determines the transfer destination of the communication data with reference to the transfer information, the activation process of the second processing unit includes a first activation process and a second activation process, and in the first activation process, the second processing unit reads, from a read-only area, program implementation data for implementing an output destination setting unit that rewrites the transfer information and initial information which is information indicating that the second processing unit is not the transfer destination of the communication data, and the output destination setting unit writes the initial information in the transfer storage unit.
 9. The electronic control device according to claim 1, wherein the first processing unit and the transfer control unit are included in a data transfer unit, and the second processing unit is connected to the data transfer unit.
 10. The electronic control device according to claim 1, wherein the second processing unit and the transfer control unit are included in a data transfer unit, and the first processing unit is connected to the data transfer unit.
 11. The electronic control device according to claim 9, wherein the data transfer unit is a switch in a data link layer or a network layer, the transfer control unit is a switch core, the first processing unit is an internal processor of the switch, and the second processing unit is a microcomputer connected to the switch.
 12. The electronic control device according to claim 10, wherein the data transfer unit is a switch in a data link layer or a network layer, the transfer control unit is a switch core, the second processing unit is an internal processor of the switch, and the first processing unit is a microcomputer connected to the switch.
 13. The electronic control device according to claim 2, wherein each of the first processing unit and the second processing unit is either a first calculation unit or a second calculation unit, the electronic control device further comprising: a determination unit that rewrites the transfer information with one calculation unit, in which the activation process is completed first, among the first calculation unit and the second calculation unit set as the first processing unit and rewrites the transfer information with another calculation unit, in which the activation process is completed later, among the first calculation unit and the second calculation unit set as the second processing unit.
 14. A calculation method executed by an electronic control device including a first processing unit, a second processing unit, and a transfer control unit, wherein the second processing unit requires a longer time for an activation process than the first processing unit, the transfer control unit is capable of transferring communication data received from an outside to the first processing unit and the second processing unit, the method comprising: causing a first control part to process the communication data transferred from the transfer control unit; causing a second control part to process the communication data transferred from the transfer control unit; and causing the transfer control unit not to set the second processing unit as a transfer destination of the communication data and to set the first processing unit to be included in the transfer destination until the activation process of the second processing unit is completed, and to set at least the second processing unit as the transfer destination of the communication data when the activation process of the second processing unit is completed. 